Theo says unveil(2) is supposed to traverse exec(2) (though this seems to be broken or not implemented at present). In which case the commmit message editor would find itself without access to files it needs (startup config files, shared libs, user's home dir, etc.) Apply unveil after the log message has been written.

The previous code only worked if EDITOR contained an absolute path.

bails on empty messages, trims leading and trailing newlines this currently disables the unveil in the commit process because it's not compatible with spawning the editor also prevent commits when there are no changes